tegwick
eb9614c267
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042
88 lines
5.2 KiB
Markdown
88 lines
5.2 KiB
Markdown
# Requester workload owner source review — 2026-10-04
|
|
|
|
Owning task: INFD-WP-0005-T05. Platform request:
|
|
2c1507b2-b361-4ef9-b5d4-3245014c7c52, thread
|
|
f84637fa-2355-4971-a2dc-7f1fd01710a8. Reviewed platform source:
|
|
6b91d510395215d178d60ee8884e7fc00930a0cf, proposed CCR-2026-0032.
|
|
|
|
## Source binding acceptance
|
|
|
|
The founder-approved namespace trust boundary matches the existing create-only
|
|
requester registration. Accept the dedicated ESO auth identity
|
|
informed-decision/informed-decision-eso, audience openbao, exact-path policy,
|
|
900-second reader limits and namespace-restricted store for owner integration.
|
|
The receiving review pod keeps ServiceAccount review and UID/GID/fsGroup 10001.
|
|
Accept the required read-only 0440 projected key client-secret at
|
|
/var/run/secrets/informed-decision/requester/client-secret, without subPath.
|
|
No new issuer registration, custody seed, scope, browser route or human act is
|
|
introduced. This is source acceptance; it does not confirm live auth claims.
|
|
|
|
## Implemented composition seam
|
|
|
|
informed_decision/requester.py implements RequesterTokenProvider and
|
|
compose_intake. The provider reopens bounded projected custody per exchange,
|
|
never strips/caches the secret or caches access tokens, and requests exactly
|
|
approval:create through fixed HTTPS /token. TLS validation, five-second timeouts,
|
|
response bounds, proxy suppression and redirect refusal use JSONTransport.
|
|
RS256 signature verification against the fixed /jwks pins issuer, sole audience
|
|
approval-engine, sub informed-decision, tenant tenant:platform, service principal,
|
|
exact requester role and exact create scope. JWT lifetime must be positive and
|
|
at most 900 seconds. Failure exposes only a fixed refusal string.
|
|
The existing issuer is https://kc.coulomb.social; owner configuration must use
|
|
that exact origin (no discovery or caller-selected URL).
|
|
|
|
compose_intake binds this callback to IntakeApprovalClient and joins the existing
|
|
IntakeService ledger with a supplied TokenReview transport and reviewed registries.
|
|
It starts no listener and supplies no transport implementation for TokenReview.
|
|
No runtime JSON setting or deployment entrypoint consumes this factory yet.
|
|
|
|
Focused offline verification: 37 tests pass across requester, intake service and
|
|
bounded transport. Synthetic projected-file replacement changes the next exchange;
|
|
missing custody sends no exchange. Wrong identity, tenant, service profile,
|
|
scopes, issuer, audience, signature, expiry and excessive lifetime refuse.
|
|
This proves local behavior, not deployed projection or issuer rotation.
|
|
|
|
## Remaining technical deliveries
|
|
|
|
1. Compose the separate private intake listener in the process lifecycle and
|
|
explicit runtime config. Implement bounded, authenticated TokenReview using
|
|
API-server CA validation. Review API RBAC and submitter token audience.
|
|
2. Verify ESO's actual TokenRequest permission for the dedicated auth account;
|
|
retain boolean/identity receipt. Review exact private Service, NetworkPolicy,
|
|
projected registries and submitter grants. Keep it absent from public ingress.
|
|
3. Build and publish the final owner image only after composition is complete;
|
|
retain immutable registry manifest digest, rendered configuration digest and
|
|
owner source revision. None exists for this new provider yet. Existing deployed
|
|
image/config references cannot be claimed to contain it.
|
|
4. Owner acceptance of receiving verification/abort attendance remains required.
|
|
This worker owns source review only, and cannot assign a human attendance role.
|
|
|
|
## Bounded native proof and abort plan
|
|
|
|
Before promotion, record exact ESO auth role, effective policy and all TTL bounds;
|
|
prove SecretSynced, exact file projection and safe annotation metadata with the
|
|
platform maintained helper. Refuse sibling data GET, parent metadata LIST, wrong
|
|
namespace/account/audience. Obtain one create-only service exchange and native
|
|
approve/read/consume refusal. Keep proof to non-secret identities, counts,
|
|
digests, timestamps and capability booleans.
|
|
|
|
Coordinated issuer rotation must prove the actual mounted-file refresh reaches
|
|
this callback and the predecessor ceases working. File replacement in an offline
|
|
test is not issuer rotation/revocation evidence. Check reader expiry/revocation,
|
|
materialized credential persistence and attended admin cleanup separately.
|
|
The runtime verifier/abort operator must retain these receipts; do not print a
|
|
Secret, bearer token, accessor, annotations, upstream body or raw child error.
|
|
|
|
On partial failure, stop, retain non-secret actual state and reconcile; never
|
|
repost an unresolved approval create. Platform abort withdraws the new projection
|
|
and disables/revokes only the new ESO reader via reviewed admin custody. Target
|
|
Secret removal is separate because Retain preserves it. The owner rollback uses
|
|
the prior admitted image/config and closes the new private listener. Existing
|
|
issuer, browser and attended requester lanes remain independent.
|
|
|
|
## Human decisions
|
|
|
|
No repeated design decision is needed for this accepted boundary. The remaining
|
|
human action is separate founder approval of the final concrete live packet and
|
|
named verification/abort attendance, after these technical gaps are closed.
|
|
No live apply, credential read, rotation, issuer mutation or deployment occurred.
|